Can someone in the know give me please give a clue how ip6_output() routes link-local addresses? I can't find any special case in there or in in6_selectroute()/selectroute() for that. Is there some magic elsewhere in the routing cache or what do I overlook?